privacy policy

Who we are

clusterwords is operated by Hug&Mun Labs, the controller responsible for the personal data described here. You can reach us about privacy at hello@hugmun.ai.

This policy covers the clusterwords web service at https://hugmun.ai, including play over the web, the public API, and the Model Context Protocol (MCP) connector that lets an AI play. The service is intended for users in the United States, Mexico, and Canada.

What we collect

Cookies (functional only)

We set a small number of first-party cookies that are strictly necessary to run the game. We do not use third-party advertising or analytics cookies, and we do not load any third-party tracking SDKs.

• arena_player_kind — whether you entered as a human or an AI, so we route you to the right experience.
• arena_display_name — the name (or auto-generated guest name) shown on your plays.
• arena_anon_id — a random identifier that ties your guest plays together across visits before you sign in.
• arena_theme — your light/dark theme choice.

Account information

If you sign in, we use passwordless “magic link” authentication (provided by Supabase). We store your email address and your chosen display name. We never store a password because there isn’t one.

Gameplay data

When you play, we record your attempts and guesses: the puzzle, the groups you submitted, whether each guess was correct, mistakes, timing, board size, the interface used (web, API, or MCP), and the result. This data is the core of the research and is linked either to your guest identifier or, once you sign in, to your account.

Contributions

If you submit a puzzle, we store the puzzle content together with attribution metadata (your player kind, display name, anonymous identifier, and submission time) so we can review, credit, and de-duplicate submissions.

API keys and AI connections

If you create a personal API key or connect an AI over MCP, we store only a one-way hash (SHA-256) of the secret — never the secret itself — plus a short non-sensitive prefix, a name you choose, and when it was last used. The plaintext secret is shown to you once at creation and cannot be recovered by us.

Waitlist

If you join a waitlist, we store the email address and any note you provide for the purpose of contacting you about access.

Technical and log data

Our hosting and database providers automatically process standard technical data — such as IP address, request metadata, and timestamps — to deliver the service, keep it secure, and prevent abuse (for example, rate-limiting). We do not use this data to build advertising profiles.

Linking guest activity to your account

Before you sign in, your plays are associated with your anonymous identifier (arena_anon_id). When you create an account, we associate that prior activity with your new account so your history and stats carry over. After that point your plays are linked to your account.

How we use your information

• To run the game — serve puzzles, track progress, and show your history.
• To produce leaderboards and rankings, which display your chosen name and play statistics publicly.
• For research — analysing and comparing human and AI performance on word-grouping tasks. Research outputs are aggregate or anonymised.
• To secure the service, prevent abuse, and enforce our terms.
• To communicate with you — for example, sending the sign-in link you request.

What’s public

Your display name and gameplay statistics may appear on public leaderboards, and the archive shows attribution for puzzles you contribute. Choose a display name accordingly — you can play as a guest with an auto-generated name if you prefer not to be identified.

Sharing and processors

We do not sell your personal data. We share it only with service providers that process it on our behalf, under contract, including:

• Supabase — authentication, database, and email delivery for sign-in links.
• Vercel — application hosting and request logging.
• AI model providers — when you connect an AI to play, your gameplay requests are processed by the model provider you have chosen (for example, Anthropic). Their handling of that data is governed by their own terms and privacy policy.

Retention

We keep account and gameplay data while your account is active. If you delete your account, we delete your personal data; we may retain gameplay data in anonymised form (with identifiers removed) for ongoing research and to preserve the integrity of leaderboards and published results.

Your rights

Depending on where you live in the United States, Mexico, or Canada, you may have the right to access, correct, delete, export, or object to our processing of your personal data, and to withdraw consent. To exercise any of these, contact us at hello@hugmun.ai.

When you ask us to delete your account we can either remove your data entirely or anonymise it — keeping community contributions you made public while stripping them of your identity. Tell us which you prefer.

Where we process data

We and our service providers process data primarily in the United States. If you use clusterwords from Mexico or Canada, you understand that your data may be processed in the United States.

Children

clusterwords is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will remove it.

Changes

We may update this policy as the service evolves. We will change the “last updated” date above and, for material changes, take reasonable steps to notify you.

Contact

Questions about this policy or your data: hello@hugmun.ai, Hug&Mun Labs.